CVE-2026-74511

A use-after-free vulnerability exists in the Linux kernel's Bluetooth management (mgmt) subsystem . The root cause is a race condition in pending_eir_or_class(), which failed to include MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting command and walked hdev->mgmt_pending without holding hdev-...

CVE-2026-74510 Bluetooth: mgmt: fix UAF in pair command cancellation

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMTOPPAIRDEVICE command by walking hdev-mgmtpending. The lookup returned a command that was...

CVE-2026-72335

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hciaddadvmonitor publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...

PT-2026-72963

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT OP SET LOCAL NAME is handled asynchronously on powered controllers and can run set name sync. When the controller is BR/EDR capable, set name sync updates the local nam...

SUSE CVE-2026-68391

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

CVE-2026-68394

A flaw was found in the Bluetooth Management MGMT component of the Linux kernel. A use-after-free vulnerability occurs when the MGMTOPLOADCONNPARAM operation queues a connection update. If a subsequent request frees the associated memory before the update is processed, it can lead to a system cra...

CVE-2026-68392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev-lock for hciconn lookup and hciabortconn. Don't use RCU to ensur...

CVE-2026-68394

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

CVE-2026-68391

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

UBUNTU-CVE-2026-68394

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

UBUNTU-CVE-2026-68391

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

AZL-93665 CVE-2026-64433 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete adddevicecomplete runs from the hcicmdsyncwork kworker, which holds only hcireqsynclock and not hcidevlock. It calls hciconnparamslookup and then dereferences the...

CVE-2026-53255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlvdataisvalid reads each advertising data field length from datai, then inspects datai + 1 for managed EIR types before checking that the current field still fits insi...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

AZL-89670 CVE-2026-43059 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs" introduced mgmtpendingvalid, which not only validates the pending command but also unlinks it from...

RHEL 9 : kernel-rt (RHSA-2026:9512)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9512 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

SUSE SLES15 Security Update : kernel (Live Patch 2 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:1132-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1132-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.6 fixes various security issues The following security issues were fixed: -...

SUSE-SU-2026:20886-1 Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-34.1 fixes various security issues The following security issues were fixed: - CVE-2025-38488: smb: client: fix use-after-free in cryptmessage when using async crypto bsc1247240. - CVE-2025-40258: mptcp: fix race condition in mptcpschedulewor...

SUSE-SU-2026:20862-1 Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-32.1 fixes various security issues The following security issues were fixed: - CVE-2025-38488: smb: client: fix use-after-free in cryptmessage when using async crypto bsc1247240. - CVE-2025-40258: mptcp: fix race condition in mptcpschedulewor...

SUSE-SU-2026:20896-1 Security update for the Linux Kernel RT (Live Patch 10 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-34.1 fixes various security issues The following security issues were fixed: - CVE-2025-38488: smb: client: fix use-after-free in cryptmessage when using async crypto bsc1247240. - CVE-2025-40258: mptcp: fix race condition in mptcpschedulewor...